Over the last decade, network devices that access the Internet or other publicly accessible networks have been increasingly subjected to malicious attacks. These malicious attacks may simply involve the use of stolen credentials by an unauthorized person in efforts to illicitly gain access to information stored within a network device. However, other malicious attacks may be more complex.
In general, malicious attacks may be carried out via an exploit or malware. An exploit is information that attempts to take advantage of a vulnerability in computer software or systems by adversely influencing or attacking normal operations of a targeted computer.
For example, malicious attacks may involve malicious software that has been downloaded by the network device. In some situations, the victim is unaware that the malicious software has been downloaded and stored within her network device. In other situations, the victim is aware that the software has been downloaded, but is unaware of its malicious activity. After being stored on the victim's network device, malicious software may, by design, compromise the network device, for example, by employing an exploit to take advantage of a software vulnerability in the network device in order to harm or co-opt operation of the network device. For instance, the malicious software may (i) gain access to certain stored information and attempt to upload such information to a targeted Command and Control (CnC) server or (ii) establish connectivity between the network device to a remote computer in efforts to exfiltrate stored information.
New malicious software is released to the Internet regularly. The speed at which attackers revise the attacks of their malicious software through code modifications requires cyber security service providers to match this speed in revising detection capabilities for these threats. For a two-stage threat detection platform, which conducts both static and dynamic analysis of incoming data, a classification engine that classifies whether the data under analysis is “malicious” (e.g., a classification that identifies a certain likelihood that the data is malicious), needs to be regularly updated to remain effective.
The classification engine is responsible for classifying data as malicious or not based on whether such data includes one or more features that already have been determined to suggest maliciousness at an associated probability level. These features may include (i) a particular file size, (ii) presence of an attachment, (iii) format type (e.g., whether the file includes an executable, a portable document format “pdf” document, etc.), (iv) specific data patterns, (v) source of the file, and (vi) a structure of the file. Reliance on manually initiated updates for the classification engine tends to be problematic as these updates are not regularly provided, due to human error in some cases. A technique is needed that will automatically update the detection capabilities of the classification engine with a reduced update cycle time.